CVE-2024-21661: Argoproj Argo CD DoS Vulnerability

CVE-2024-21661 Overview

CVE-2024-21661 is a Denial of Service (DoS) vulnerability in Argo CD, the declarative GitOps continuous delivery tool for Kubernetes. The flaw exists in versions prior to 2.8.13, 2.9.9, and 2.10.4. An unauthenticated attacker can crash the application by triggering unsafe concurrent manipulation of an array in the session manager. Because exploitation requires no authentication and can be repeated indefinitely, attackers can render Argo CD permanently unavailable to legitimate users. The issue is tracked under GHSA-6v85-wr92-q4p7 and is associated with [CWE-787].

Critical Impact
Unauthenticated remote attackers can repeatedly crash Argo CD, disrupting GitOps pipelines and blocking all Kubernetes deployment operations managed through the platform.

Affected Products

Argo CD versions prior to 2.8.13
Argo CD 2.9.x versions prior to 2.9.9
Argo CD 2.10.x versions prior to 2.10.4

Discovery Timeline

2024-03-18 - CVE-2024-21661 published to NVD
2025-01-09 - Last updated in NVD database

Technical Details for CVE-2024-21661

Vulnerability Analysis

The vulnerability resides in Argo CD's session management code, specifically within util/session/sessionmanager.go. The application modifies a shared array while concurrent goroutines iterate over it. This concurrent read-write pattern violates Go's memory model and triggers a runtime panic that terminates the Argo CD server process.

Because Argo CD exposes session-related endpoints without requiring authentication for the affected code path, any network-reachable attacker can trigger the race. Continuous exploitation prevents recovery, since each restart can be immediately followed by another crash, producing a sustained outage of the GitOps control plane.

Root Cause

The root cause is unsynchronized concurrent access to a shared data structure inside the SessionManager. The pre-patch implementation passed util_session.SessionManager by value to terminal and websocket handlers, producing multiple copies of an object containing internal state that was not safe for concurrent mutation. When two goroutines manipulated the same underlying array simultaneously, the Go runtime panicked, crashing the entire process.

Attack Vector

The attack vector is network-based and does not require authentication, user interaction, or elevated privileges. An attacker sends concurrent requests that exercise the vulnerable session manager code path. The race condition between iteration and mutation causes the Go runtime to detect concurrent map or slice access and abort the process.

// Patch: server/application/terminal.go
// SessionManager is now passed by pointer to ensure all
// callers share a single synchronized instance.

 	allowedShells     []string
 	namespace         string
 	enabledNamespaces []string
-	sessionManager    util_session.SessionManager
+	sessionManager    *util_session.SessionManager
 }

 // NewHandler returns a new terminal handler.
 func NewHandler(appLister applisters.ApplicationLister, namespace string, enabledNamespaces []string, db db.ArgoDB, enf *rbac.Enforcer, cache *servercache.Cache,
-	appResourceTree AppResourceTreeFn, allowedShells []string, sessionManager util_session.SessionManager) *terminalHandler {
+	appResourceTree AppResourceTreeFn, allowedShells []string, sessionManager *util_session.SessionManager) *terminalHandler {
 	return &terminalHandler{
 		appLister:         appLister,
 		db:                db,

Source: argoproj/argo-cd commit 2a22e19

// Patch: server/application/websocket.go
// websocket handler also updated to share a pointer to SessionManager.

 	tty            bool
 	readLock       sync.Mutex
 	writeLock      sync.Mutex
-	sessionManager util_session.SessionManager
+	sessionManager *util_session.SessionManager
 	token          *string
 }

Source: argoproj/argo-cd commit 5bbb51a

Detection Methods for CVE-2024-21661

Indicators of Compromise

Unexpected crashes or restarts of the argocd-server pod in Kubernetes, often visible as CrashLoopBackOff status.
Go runtime panic messages in Argo CD server logs referencing concurrent map or slice access.
Repeated bursts of unauthenticated requests to Argo CD session or API endpoints from a single source.

Detection Strategies

Monitor pod restart counts and exit codes for argocd-server to identify abnormal restart patterns.
Inspect Argo CD server logs for fatal error: concurrent or runtime error panic traces.
Correlate ingress or load balancer logs with Argo CD restart events to identify the source of triggering requests.

Monitoring Recommendations

Configure alerts on Kubernetes pod restart thresholds for the Argo CD namespace.
Track inbound request rates to Argo CD endpoints and alert on sudden volume spikes from individual clients.
Forward Argo CD application and ingress logs to a centralized SIEM or data lake for retrospective analysis of crash patterns.

How to Mitigate CVE-2024-21661

Immediate Actions Required

Upgrade Argo CD to version 2.8.13, 2.9.9, 2.10.4, or later, depending on your current release branch.
Restrict network exposure of the Argo CD API server to trusted networks using Kubernetes NetworkPolicy or an upstream reverse proxy.
Place Argo CD behind an authenticating gateway or VPN to reduce the pool of potential attackers.

Patch Information

The Argo CD maintainers released fixes in versions 2.8.13, 2.9.9, and 2.10.4. The patches change the SessionManager from a value-type field to a pointer, ensuring all handlers share a single synchronized instance rather than independent copies with divergent state. The fix commits are 2a22e19, 5bbb51a, and ce04dc5. Full advisory details are in GHSA-6v85-wr92-q4p7.

Workarounds

Limit ingress to the Argo CD API to known administrative IP ranges via NetworkPolicy or ingress controller rules.
Deploy a rate-limiting reverse proxy in front of Argo CD to throttle bursts of unauthenticated requests.
Configure Kubernetes liveness probes and high-availability replicas so that any single crash does not produce a sustained outage while patching is scheduled.

bash

# Example: upgrade Argo CD via Helm to a patched version
helm repo update
helm upgrade argo-cd argo/argo-cd \
  --namespace argocd \
  --version <chart-version-with-argocd-2.10.4-or-later>

# Verify the running Argo CD version
kubectl -n argocd exec deploy/argocd-server -- argocd version --short